Improper Access Control

S3 Gateway is vulnerable to Improper Access Control. The vulnerability is due to inadequate authorization checks, allowing authenticated users to send requests to the delete-objects API and delete files they are not authorized to access...

CVE-2024-46280

PIX-LINK LV-WR22 RE3002-P1-01V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, without the possibility of changing them...

PIX-LINK LV-WR22 安全漏洞

The PIX-LINK LV-WR22 is a wireless repeater from PIX-LINK. A security vulnerability exists in the PIX-LINK LV-WR22 RE3002-P1-01V117.0 version, which stems from vulnerability to improper access control attacks...

CVE-2024-46280

PIX-LINK LV-WR22 RE3002-P1-01V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, without the possibility of changing them...

CVE-2024-46280

PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is affected by Improper Access Control due to TELNET being enabled with root-level credentials that cannot be changed. The issue is documented across multiple sources (NVD/Red Hat/CVE listings) with a CVSS v3.1 base score of 8.8 (High) and adjacent attack vect...

CVE-2024-46280

PIX-LINK LV-WR22 RE3002-P1-01V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak credentials for a root-level account, without the possibility of changing them...

PT-2024-31948 · Sourcecodester · Sourcecodester Online Medicine Ordering System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Medicine Ordering System version 1.0 Description: The issue is related to Incorrect Access Control, where there is a lack of authorization checks for admin operations. Specifically, an attacker can perform admin-level...

CVE-2024-9298

A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access...

CVE-2024-9298 SourceCodester Online Railway Reservation System Ticket ?page=tickets access control

A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access...

CVE-2024-9298

CVE-2024-9298 affects SourceCodester Online Railway Reservation System 1.0, specifically the Ticket Handler’s /?page=tickets functionality. The vulnerability arises from improper access controls when manipulating the id argument, enabling a remote attacker to access parts of the system. The issue...

Improper Access Control

Mautic is vulnerable to Improper Access Control. The vulnerability is due to the lack of mechanisms to verify user permissions during the update process via the user interface, allowing an attacker to access sensitive information...

Local File Inclusion (LFI)

vite is vulnerable to arbitrary file exposure. The vulnerability is due to improper enforcement of file access restrictions in the @fs mechanism, allowing attackers to bypass the allow list by adding ?import to the URL and retrieving the contents of arbitrary files...

CVE-2024-9003

A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFileLoad.do of the component Attachment Handler. The manipulation of the argument oid leads to improper acce...

CVE-2024-9003 Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control

A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFileLoad.do of the component Attachment Handler. The manipulation of the argument oid leads to improper acce...

CVE-2024-9003 Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control

A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFileLoad.do of the component Attachment Handler. The manipulation of the argument oid leads to improper acce...

CVE-2022-25768 Improper Access Control in UI upgrade process

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade proces...

Mautic vulnerable to Improper Access Control in UI upgrade process

Impact The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to the UI upgrade process. An attacker can access the version number or execute parts of the upgrade process without proper permissions. Note: As upgrading in the user interface is deprecated, this...

GHSA-X3JX-5W6M-Q2FC Mautic vulnerable to Improper Access Control in UI upgrade process

Impact The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to the UI upgrade process. An attacker can access the version number or execute parts of the upgrade process without proper permissions. Note: As upgrading in the user interface is deprecated, this...